@saluzi/saluzi-edu 0.5.21 → 0.6.0

package/packages/remote-control-server/src/client-ip.ts

@@ -0,0 +1,57 @@
+import type { Context } from 'hono'
+
+/**
+ * Best-effort client (peer) address for an incoming request.
+ *
+ * Cross-runtime: RCS serves via Bun.serve (index.ts) in the bundled CLI and
+ * via @hono/node-server (nodeServer.ts) under Node. Bun passes the Server
+ * object as `c.env` (which exposes `requestIP()`); @hono/node-server exposes
+ * the raw socket at `c.env.incoming.socket.remoteAddress`. Proxied
+ * deployments (Docker + reverse proxy) put the real address in
+ * X-Forwarded-For / X-Real-IP, which win when present.
+ *
+ * Returns null when no address can be resolved — callers must treat the IP
+ * as optional (the Web UI omits it rather than rendering a blank).
+ *
+ * Client-supplied headers are untrusted: this value is display-only (an
+ * environment row's "where did this connect from"), never used for access
+ * control.
+ */
+export function getClientIp(c: Context): string | null {
+  const forwarded = c.req.header('x-forwarded-for')
+  if (forwarded) {
+    const first = forwarded.split(',')[0]?.trim()
+    if (first) return normalizeIp(first)
+  }
+  const real = c.req.header('x-real-ip')
+  if (real?.trim()) return normalizeIp(real.trim())
+
+  const env = c.env as unknown as
+    | {
+        requestIP?: (req: Request) => { address?: string } | null
+        incoming?: { socket?: { remoteAddress?: string } }
+      }
+    | undefined
+
+  // Bun.serve: the server object exposes requestIP(request).
+  try {
+    const info = env?.requestIP?.(c.req.raw)
+    if (info?.address) return normalizeIp(info.address)
+  } catch {
+    /* not available on this runtime */
+  }
+
+  // @hono/node-server: raw Node socket.
+  const remote = env?.incoming?.socket?.remoteAddress
+  if (remote) return normalizeIp(remote)
+
+  return null
+}
+
+/** Map IPv4-mapped IPv6 (`::ffff:127.0.0.1`) to its IPv4 form; strip brackets. */
+function normalizeIp(addr: string): string {
+  const v = addr.trim()
+  if (v.startsWith('::ffff:')) return v.slice('::ffff:'.length)
+  if (v.startsWith('[') && v.endsWith(']')) return v.slice(1, -1)
+  return v
+}

package/packages/remote-control-server/src/db/sqlite.ts

@@ -173,6 +173,28 @@ export function migrateDatabase(db: Database): void {
   // all columns.
   migrateEnvironmentsColumns(db)
   db.exec(schema)
+  releaseDeletedTeamSlugs(db)
+}
+
+/**
+ * Release the slugs of teams soft-deleted before DELETE /teams/:id learned to
+ * rename the slug on delete. `teams.slug` carries an unconditional UNIQUE
+ * constraint, so a deleted row keeps its slug reserved; the create-time
+ * uniqueness check only looks at live rows, which made re-creating a team with
+ * a previously deleted slug fail on the index after passing the check.
+ * Idempotent: the `-deleted-` marker skips rows already released (either by
+ * the delete handler or by a previous run of this migration).
+ */
+function releaseDeletedTeamSlugs(db: Database): void {
+  const tableExists = db
+    .query("SELECT 1 FROM sqlite_master WHERE type='table' AND name='teams'")
+    .get() as { 1: number } | undefined
+  if (!tableExists) return
+
+  db.query(
+    `UPDATE teams SET slug = slug || '-deleted-' || id
+     WHERE deleted_at IS NOT NULL AND slug NOT LIKE '%-deleted-%'`,
+  ).run()
 }
 
 /**

package/packages/remote-control-server/src/routes/v1/environments.ts

@@ -14,6 +14,7 @@ import {
   resolveUserIdUuid,
 } from '../../auth/bridge-auth'
 import { getDb } from '../../db/sqlite'
+import { getClientIp } from '../../client-ip'
 import { isSessionClosedStatus } from '../../services/session'
 import { getSingleUserAdminUuid } from '../../services/single-user'
 import {
@@ -241,6 +242,9 @@ app.post('/bridge', acceptCliHeaders, bridgeAuth, async c => {
   const result = registerEnvironment({
     ...body,
     username,
+    // Peer address captured at registration — surfaced in the Web UI's
+    // environment list so a machine is identifiable beyond its hostname.
+    ipAddress: getClientIp(c),
     ownerUserId,
     teamId: teamId || null,
     claimToken,

package/packages/remote-control-server/src/routes/web/teams.ts

@@ -387,8 +387,19 @@ app.delete('/teams/:id', withAuth, async c => {
   }
 
   const now = new Date().toISOString()
-  db.query('UPDATE teams SET deleted_at = $now WHERE id = $id').run({
+  // Soft delete AND release the slug. `teams.slug` carries an unconditional
+  // UNIQUE constraint, while the create-time uniqueness check only looks at
+  // live rows (`deleted_at IS NULL`) — so without renaming here a deleted team
+  // would hold its slug forever and re-creating a team with the same slug
+  // would pass the check yet fail the INSERT on the index. The archived value
+  // is unique (teamId is the PK) and inert: deleted teams are only addressed
+  // by id (by-slug and every list filter exclude `deleted_at`).
+  const teamSlug = String(result.team.slug ?? '')
+  db.query(
+    'UPDATE teams SET deleted_at = $now, slug = $slug WHERE id = $id',
+  ).run({
     $now: now,
+    $slug: `${teamSlug}-deleted-${teamId}`,
     $id: teamId,
   })
 

package/packages/remote-control-server/src/services/environment.ts

@@ -30,6 +30,7 @@ function toResponse(
     teamId?: string | null
     teamName?: string | null
     ownerUserId?: string | null
+    ownerUsername?: string | null
   },
 ): EnvironmentResponse {
   return {
@@ -39,13 +40,18 @@ function toResponse(
     branch: row.branch,
     status: row.status,
     username: row.username,
+    ip_address: row.ipAddress,
     last_poll_at: row.lastPollAt ? row.lastPollAt.getTime() / 1000 : null,
+    created_at: row.createdAt ? row.createdAt.getTime() / 1000 : null,
     worker_type: row.workerType,
     channel_group_id: row.bridgeId,
     capabilities: row.capabilities,
     team_id: row.teamId ?? null,
     team_name: row.teamName ?? null,
     owner_user_id: row.ownerUserId ?? null,
+    // Attribution: prefer the owning account's username; fall back to the
+    // OS user the worker reported at registration.
+    owner_username: row.ownerUsername ?? row.username ?? null,
     attach_waiting:
       row.sessionMode === 'attach' &&
       !storeListSessionsByEnvironment(row.id).some(
@@ -69,6 +75,7 @@ export function registerEnvironment(
     environment_id?: string
     metadata?: { worker_type?: string }
     username?: string
+    ipAddress?: string | null
     ownerUserId?: string | null
     teamId?: string | null
     claimToken?: string | null
@@ -97,6 +104,9 @@ export function registerEnvironment(
         machineName: req.machine_name,
         maxSessions: req.max_sessions,
         capabilities: req.capabilities ?? null,
+        // Refresh the peer address on every re-registration — a laptop that
+        // hopped networks should report its new address, not a stale one.
+        ...(req.ipAddress ? { ipAddress: req.ipAddress } : {}),
         sessionMode,
       })
       // Ownership is backfill-only: a restart must not reassign the env
@@ -158,6 +168,7 @@ export function registerEnvironment(
         capabilities: req.capabilities ?? null,
         machineName: req.machine_name,
         maxSessions: req.max_sessions,
+        ...(req.ipAddress ? { ipAddress: req.ipAddress } : {}),
       })
       // Backfill ownership: the reused env may still be unowned (claim flow
       // pending). Idempotent — storeClaimEnvironment only writes when
@@ -210,6 +221,7 @@ export function registerEnvironment(
     workerType,
     bridgeId: req.bridge_id,
     username: req.username,
+    ipAddress: req.ipAddress ?? undefined,
     capabilities: req.capabilities,
     ownerUserId: req.ownerUserId,
     claimToken: req.claimToken,

package/packages/remote-control-server/src/store.ts

@@ -21,6 +21,14 @@ export interface EnvironmentRecord {
   capabilities: Record<string, unknown> | null
   status: string
   username: string | null
+  /**
+   * Peer address the worker registered from (captured at POST
+   * /v1/environments/bridge). In-memory only — like maxSessions/bridgeId the
+   * environments table has no column for it, and workers re-register with a
+   * fresh address on every restart. Null when the runtime couldn't resolve a
+   * peer address (e.g. a WS-only ACP path); the Web UI simply omits it.
+   */
+  ipAddress: string | null
   lastPollAt: Date | null
   createdAt: Date
   updatedAt: Date
@@ -123,6 +131,7 @@ export function storeCreateEnvironment(req: {
   workerType?: string
   bridgeId?: string
   username?: string
+  ipAddress?: string
   capabilities?: Record<string, unknown>
   ownerUserId?: string | null
   claimToken?: string | null
@@ -144,6 +153,7 @@ export function storeCreateEnvironment(req: {
     capabilities: req.capabilities ?? null,
     status: 'active',
     username: req.username ?? null,
+    ipAddress: req.ipAddress ?? null,
     lastPollAt: now,
     createdAt: now,
     updatedAt: now,
@@ -192,6 +202,7 @@ export function storeUpdateEnvironment(
       | 'machineName'
       | 'maxSessions'
       | 'bridgeId'
+      | 'ipAddress'
       | 'sessionMode'
     >
   >,
@@ -221,8 +232,8 @@ export function storeUpdateEnvironment(
       params.$sessionMode = patch.sessionMode
     }
 
-    // bridgeId, maxSessions, capabilities, updatedAt are in-memory only —
-    // the environments table has no corresponding columns.
+    // bridgeId, maxSessions, capabilities, ipAddress, updatedAt are
+    // in-memory only — the environments table has no corresponding columns.
 
     if (sets.length > 0) {
       db.query(`UPDATE environments SET ${sets.join(', ')} WHERE id = $id`).run(
@@ -249,6 +260,7 @@ export function storeListActiveEnvironmentsWithTeam(): Array<
     teamId: string | null
     teamName: string | null
     ownerUserId: string | null
+    ownerUsername: string | null
   }
 > {
   const active = [...environments.values()].filter(e => e.status === 'active')
@@ -256,8 +268,13 @@ export function storeListActiveEnvironmentsWithTeam(): Array<
 
   // Build a map of env_id → { teamId, teamName } from SQLite
   const teamMap = new Map<string, { teamId: string; teamName: string }>()
-  // Build a map of env_id → ownerUserId from SQLite
-  const ownerMap = new Map<string, string | null>()
+  // Build a map of env_id → { ownerUserId, ownerUsername } from SQLite.
+  // The username is joined here (rather than in the response layer) so the
+  // Web UI can attribute an environment to a human without a second query.
+  const ownerMap = new Map<
+    string,
+    { userId: string; username: string | null }
+  >()
   try {
     const db = getDb()
     const rows = db
@@ -279,11 +296,21 @@ export function storeListActiveEnvironmentsWithTeam(): Array<
     }
     const ownerRows = db
       .query(
-        `SELECT id, owner_user_id FROM environments WHERE owner_user_id IS NOT NULL`,
+        `SELECT e.id, e.owner_user_id, u.username AS owner_username
+         FROM environments e
+         LEFT JOIN users u ON u.id = e.owner_user_id
+         WHERE e.owner_user_id IS NOT NULL`,
       )
-      .all() as Array<{ id: string; owner_user_id: string }>
+      .all() as Array<{
+      id: string
+      owner_user_id: string
+      owner_username: string | null
+    }>
     for (const row of ownerRows) {
-      ownerMap.set(row.id, row.owner_user_id)
+      ownerMap.set(row.id, {
+        userId: row.owner_user_id,
+        username: row.owner_username,
+      })
     }
   } catch (err) {
     console.error(
@@ -295,11 +322,13 @@ export function storeListActiveEnvironmentsWithTeam(): Array<
 
   return active.map(env => {
     const team = teamMap.get(env.id)
+    const owner = ownerMap.get(env.id)
     return {
       ...env,
       teamId: team?.teamId ?? null,
       teamName: team?.teamName ?? null,
-      ownerUserId: ownerMap.get(env.id) ?? null,
+      ownerUserId: owner?.userId ?? null,
+      ownerUsername: owner?.username ?? null,
     }
   })
 }

package/packages/remote-control-server/src/types/api.ts

@@ -135,13 +135,20 @@ export interface EnvironmentResponse {
   branch: string | null
   status: string
   username: string | null
+  /** Peer address the worker registered from. Null when unresolvable. */
+  ip_address: string | null
   last_poll_at: number | null
+  /** Unix seconds when the machine first registered (stable across restarts
+   *  within a server lifetime). Null only for legacy rows. */
+  created_at: number | null
   worker_type?: string
   channel_group_id?: string | null
   capabilities?: Record<string, unknown> | null
   team_id: string | null
   team_name: string | null
   owner_user_id: string | null
+  /** Resolved username of the owning user (null if unowned/unresolvable). */
+  owner_username?: string | null
   /** Session Attach wait mode: registered to be assigned a session, none bound yet. */
   attach_waiting?: boolean
 }

package/packages/remote-control-server/web/dist/assets/AdminPanel-D0fVkpU2.js

@@ -0,0 +1 @@
+import{e as d,j as e}from"./vendor-DE_-CLIE.js";import{aL as x,aM as o,a3 as m,aD as s,at as l,I as u}from"./main-BC4mcO_f.js";import"./preload-helper-BiaRt2Oj.js";import"./motion-BILbV7YQ.js";function j(){x();const[a,i]=d.useState([]),{myTeams:r,isLoading:c}=o(),n=d.useCallback(async()=>{try{const t=await m();i(t||[])}catch(t){console.error("Admin: failed to load sessions",t)}},[]);return d.useEffect(()=>{n()},[n]),e.jsx("div",{className:"flex-1 overflow-y-auto",children:e.jsxs("div",{className:"mx-auto max-w-5xl px-4 py-8",children:[e.jsx("h1",{className:"mb-6 font-display text-2xl font-semibold text-text-primary",children:s("admin.title")}),e.jsxs("section",{className:"mb-10",children:[e.jsxs("h2",{className:"mb-4 font-display text-lg font-semibold text-text-primary",children:[s("admin.teams")," (",r.length,")"]}),c?e.jsx("div",{className:"rounded-xl border border-border bg-surface-1 p-4 text-center text-text-muted",children:s("common.loading")}):r.length===0?e.jsx("div",{className:"rounded-xl border border-border bg-surface-1 p-4 text-center text-text-muted",children:s("admin.noTeams")}):e.jsx("div",{className:"space-y-2",children:r.map(t=>e.jsxs("a",{href:`/teams/${t.slug}`,className:"flex items-center justify-between rounded-xl border border-border bg-surface-1 px-4 py-3 no-underline transition-colors hover:border-border-light hover:bg-surface-2",children:[e.jsxs("div",{className:"min-w-0",children:[e.jsx("span",{className:"font-medium text-text-primary",children:t.name}),e.jsx("span",{className:"ml-2 text-xs text-text-muted",children:t.slug})]}),e.jsx("span",{className:"text-xs text-text-muted",children:l(new Date(t.created_at).getTime()/1e3)})]},t.id))})]}),e.jsxs("section",{children:[e.jsxs("h2",{className:"mb-4 font-display text-lg font-semibold text-text-primary",children:[s("admin.sessions")," (",a.length,")"]}),a.length===0?e.jsx("div",{className:"rounded-xl border border-border bg-surface-1 p-4 text-center text-text-muted",children:s("admin.noSessions")}):e.jsx("div",{className:"space-y-2",children:a.map(t=>e.jsxs("a",{href:`/code/${t.id}`,className:"flex items-center justify-between rounded-xl border border-border bg-surface-1 px-4 py-3 no-underline transition-colors hover:border-border-light hover:bg-surface-2",children:[e.jsxs("div",{className:"min-w-0 flex-1",children:[e.jsxs("div",{className:"flex items-center gap-2",children:[e.jsx("span",{className:"truncate font-medium text-text-primary",children:t.title||t.id}),e.jsx("span",{className:"rounded-full bg-surface-2 px-2 py-0.5 text-xs text-text-muted",children:t.source||"unknown"})]}),e.jsx("div",{className:"truncate text-xs text-text-muted",children:t.id})]}),e.jsxs("div",{className:"ml-4 flex items-center gap-3",children:[e.jsx(u,{status:t.status}),e.jsx("span",{className:"text-xs text-text-muted",children:l(t.updated_at||t.created_at)})]})]},t.id))})]})]})})}export{j as AdminPanel};

package/packages/remote-control-server/web/dist/assets/ArtifactView-DG0-kZ2G.js

@@ -0,0 +1 @@
+import{e as a,j as t}from"./vendor-DE_-CLIE.js";import{aL as A,a4 as j,aD as r,a1 as q,ao as R,P as U,N as F}from"./main-BC4mcO_f.js";import{S as O,E as G,C as K}from"./ArtifactsGallery-CcobkOm1.js";import{R as P}from"./refresh-cw-DBXI7gD3.js";import{C as J}from"./copy-EPASKX-X.js";import"./preload-helper-BiaRt2Oj.js";import"./motion-BILbV7YQ.js";import"./dialog-Ort95zkZ.js";let m=null;function M(n,c,e=0){b();const o=`/web/sessions/${n}/events`,l=new EventSource(o,{withCredentials:!0});m=l;let u=e;l.addEventListener("message",p=>{try{const x=JSON.parse(p.data);if(x.seqNum!==void 0&&x.seqNum<=u)return;x.seqNum!==void 0&&(u=x.seqNum),c(x)}catch{}}),l.addEventListener("error",()=>{console.warn("[SSE] error, readyState:",l.readyState),l.readyState===EventSource.CLOSED&&(l.close(),b())})}function b(){m&&(m.close(),m=null)}function V(n,c){const e=a.useRef(c);e.current=c;const o=a.useCallback(l=>{e.current(l)},[]);a.useEffect(()=>{if(n)return M(n,o),()=>{b()}},[n,o])}function I({artifactId:n,onBack:c}){A();const[e,o]=a.useState(null),[l,u]=a.useState(""),[p,x]=a.useState(!1),[S,f]=a.useState(0),[w,h]=a.useState(!1),[g,C]=a.useState(null),[E,k]=a.useState("template"),[d,y]=a.useState(!1);a.useEffect(()=>{let s=!1;return j(n).then(i=>{s||o(i)}).catch(i=>{s||u(i instanceof Error?i.message:r("artifacts.viewNotFound"))}),()=>{s=!0}},[n]);const v=a.useCallback(()=>{j(n).then(s=>o(s)).catch(()=>{})},[n]),_=a.useCallback(s=>{var i;s.type==="artifact_updated"&&((i=s.payload)!=null&&i.id&&s.payload.id!==n||(v(),f(D=>D+1),y(!0)))},[n,v]);V((e==null?void 0:e.session_id)??null,_),a.useEffect(()=>{if(!d)return;const s=setTimeout(()=>y(!1),2500);return()=>clearTimeout(s)},[d]);const N=a.useCallback(s=>{e&&(C(e),k(s),h(!0))},[e]),$=a.useCallback(s=>{h(!1),o(i=>i?{...i,...s}:s),f(i=>i+1)},[]),T=a.useCallback(async()=>{if(window.confirm(r("artifacts.delete")+" — "+n.slice(0,8)+"…?"))try{await q(n),c()}catch(s){alert(s instanceof Error?s.message:r("artifacts.deleteFailed"))}},[n,c]),L=a.useCallback(async()=>{if(!e)return;await R(`${window.location.origin}${e.url}`)&&(x(!0),setTimeout(()=>x(!1),1500))},[e]);return l?t.jsx("div",{className:"flex flex-1 items-center justify-center",children:t.jsxs("div",{className:"text-center",children:[t.jsx("p",{className:"text-status-error",children:r("artifacts.viewNotFound")}),t.jsx("p",{className:"mt-1 text-xs text-text-muted",children:l}),t.jsx("button",{type:"button",onClick:c,className:"mt-4 rounded-md border border-border px-4 py-2 text-sm text-text-secondary hover:bg-surface-2",children:r("artifacts.backToGallery")})]})}):e?t.jsxs("div",{className:"flex h-full min-h-0 flex-col",children:[t.jsxs("div",{className:"flex flex-wrap items-center gap-2 border-b border-border bg-surface-1 px-4 py-2.5",children:[t.jsx("button",{type:"button",onClick:c,className:"text-sm text-text-muted hover:text-text-primary",children:r("artifacts.backToGallery")}),t.jsx("span",{className:"text-text-muted/40",children:"/"}),t.jsx("span",{className:"truncate font-medium text-text-primary",children:e.title||e.id.slice(0,12)}),t.jsx("span",{className:`rounded-full px-2 py-0.5 text-[10px] transition-colors ${d?"bg-status-active/15 text-status-active":"bg-surface-3 text-text-muted"}`,title:d?r("artifacts.view.liveUpdated"):void 0,children:d?`↻ v${e.version}`:`v${e.version}`}),e.session_id&&t.jsxs("a",{href:`/code/${e.session_id}`,className:"truncate font-mono text-[10px] text-text-muted hover:text-accent",title:e.session_id,children:[r("artifacts.session"),": ",e.session_id.slice(0,14),"…"]}),e.expires_at&&t.jsxs("span",{className:"text-[10px] text-text-muted",title:e.expires_at,children:[r("artifacts.expires"),": ",new Date(e.expires_at).toLocaleDateString()]}),t.jsxs("div",{className:"ml-auto flex items-center gap-1",children:[t.jsx("button",{type:"button",onClick:()=>f(s=>s+1),className:"inline-flex items-center gap-1 rounded-md px-2 py-1 text-xs text-text-secondary hover:bg-surface-2 hover:text-text-primary",title:r("common.loading"),children:t.jsx(P,{className:"h-3.5 w-3.5"})}),t.jsx("button",{type:"button",onClick:()=>N("ai"),className:"inline-flex items-center gap-1 rounded-md px-2 py-1 text-xs text-text-secondary hover:bg-surface-2 hover:text-text-primary",title:r("artifacts.aiUpdate"),children:t.jsx(O,{className:"h-3.5 w-3.5"})}),e.can_manage&&t.jsx("button",{type:"button",onClick:()=>N("template"),className:"inline-flex items-center gap-1 rounded-md px-2 py-1 text-xs text-text-secondary hover:bg-surface-2 hover:text-text-primary",title:r("artifacts.edit"),children:t.jsx(U,{className:"h-3.5 w-3.5"})}),t.jsxs("button",{type:"button",onClick:L,className:"inline-flex items-center gap-1 rounded-md px-2 py-1 text-xs text-text-secondary hover:bg-surface-2 hover:text-text-primary",title:`${r("artifacts.copyLink")} · ${r("artifacts.linkNotice")}`,children:[t.jsx(J,{className:"h-3.5 w-3.5"}),p&&t.jsx("span",{className:"text-status-active",children:r("artifacts.copied")})]}),t.jsx("a",{href:e.url,target:"_blank",rel:"noreferrer",className:"inline-flex items-center gap-1 rounded-md px-2 py-1 text-xs text-text-secondary hover:bg-surface-2 hover:text-text-primary",title:r("artifacts.openInNewTab"),children:t.jsx(G,{className:"h-3.5 w-3.5"})}),t.jsx("button",{type:"button",onClick:T,className:"inline-flex items-center gap-1 rounded-md px-2 py-1 text-xs text-text-secondary hover:bg-status-error/10 hover:text-status-error",title:r("artifacts.delete"),children:t.jsx(F,{className:"h-3.5 w-3.5"})})]})]}),t.jsx("iframe",{src:`${e.url}${e.url.includes("?")?"&":"?"}_=${Date.now()}`,title:e.title||e.id,className:"min-h-0 w-full flex-1 border-0 bg-white",sandbox:"allow-scripts allow-popups allow-forms"},S),t.jsx(K,{open:w,onClose:()=>h(!1),onCreated:$,editArtifact:g,initialMode:E})]}):t.jsx("div",{className:"flex flex-1 items-center justify-center text-text-muted",children:r("common.loading")})}export{I as ArtifactView};